CompTIA Cloud+ Practical Cloud Engineering

Section 1: Cloud Service Models and Shared Responsibility

• IaaS, PaaS, SaaS and FaaS (serverless) compared from a developer's point of view
• The shared responsibility model: what the provider looks after and what the organisation owns
• Choosing a service model to suit the team, the budget and the level of control needed
• An overview of the CloudHarbor Booking Platform project and the 6 CV0-004 domains

Section 2: Service Availability

• Regions, availability zones and edge locations
• How high availability, fault tolerance and disaster recovery differ
• SLA, RPO, RTO and estimating the impact of downtime
• Lab: calculate the combined availability of a multi-tier system from each service's SLA

Section 3: Lab: Cloud Networking

• VPC and VNet, public and private subnets, route tables, internet gateways and NAT gateways
• Security groups versus network ACLs
• Load balancers, DNS, CDN, and VPN or Direct Connect at a conceptual level
• Lab: build a VPC with subnets across 2 availability zones in AWS

Section 4: Lab: Storage Resources and Technologies

• Block, file and object storage and their use cases
• Storage tiers, lifecycle policies and long-term retention
• Durability, replication and encryption of stored data
• Lab: create an S3 bucket for attachments with a lifecycle policy and compare it with Azure Blob Storage

Section 5: Workshop Day 1: Virtualisation, Cost and Architecture

• Hypervisors, instance types and right-sizing
• Pricing models: on-demand, reserved instances and savings plans, and spot
• Controlling cost with tagging, budgets and the pricing calculator
• Workshop: draw a multi-tier architecture diagram across 2 AZs and estimate the monthly cost

Section 6: Cloud-native Design Concepts

• Microservices, loose coupling, stateless services and event-driven architecture
• Message queues, pub/sub and serverless functions
• Design principles for systems that scale and recover on their own
• Lab: build a Lambda function triggered by a new file in S3

Section 7: Lab: Containerisation

• Containers versus virtual machines
• Container images, registries and container orchestration (Kubernetes, Amazon ECS) at a conceptual level
• State and persistent storage for containers
• Lab: containerise the REST API with Docker and push the image to Amazon ECR

Section 8: Lab: Databases in the Cloud

• Relational versus NoSQL, and managed database services
• Replication, read replicas, Multi-AZ and database backups
• Choosing a database to fit the data model and the workload
• Lab: create a database on Amazon RDS in a private subnet

Section 9: Workload Optimisation and Evolving Technologies

• Optimising workloads with caching, auto scaling and the right instance choice
• An overview of newer cloud technologies such as AI/ML services, edge computing and serverless containers
• Criteria for assessing new technologies before adopting them
• Case study: cut the cost and response time of an over-engineered system

Section 10: Workshop Day 2: Deployment Models and Cloud Migration

• Public, private, hybrid, multi-cloud and community cloud
• Migration strategies: rehost, replatform, refactor, repurchase, retire and retain
• Assessing readiness and risk, and planning the cutover
• Workshop: write a migration plan for the existing room booking system (a simulated on-premises system) with reasons for the chosen strategy

Section 11: Infrastructure as Code

• Declarative versus imperative approaches
• Terraform or OpenTofu project structure: providers, resources, variables, outputs and modules
• Remote state and preventing conflicting changes
• Lab: rebuild the day 1 VPC entirely in Terraform

Section 12: Lab: Provisioning Cloud Resources

• Matching resources to performance, availability and budget requirements
• Provision load balancers, compute, databases and storage with code
• Configuration with user data, images and environment variables
• Lab: build every tier of the CloudHarbor infrastructure with remote state

Section 13: Deployment Strategies

• Rolling, blue-green, canary and recreate
• Immutable infrastructure and rollback
• Separate environments: dev, staging and production
• Choosing a strategy to match each system's risk and cost

Section 14: Lab: Source Control and CI/CD

• Branching strategies and the pull request workflow
• The parts of a CI/CD pipeline: build, test, scan and deploy
• Storing pipeline credentials safely with OIDC instead of long-lived access keys
• Lab: set up a pipeline that builds the container, runs tests and pushes to ECR

Section 15: Workshop Day 3: System Integration and DevOps Tools

• Integrating systems through APIs, webhooks and message queues
• The role of configuration management, container registries and artifact repositories
• GitOps at an overview level
• Workshop: have the pipeline run terraform plan and deploy to the cloud with a rolling update automatically

Section 16: Lab: Identity and Access Management

• Users, groups, roles and policies with least privilege
• MFA, federation, single sign-on and temporary credentials
• Avoiding long-lived access keys, and comparing the ideas with Microsoft Entra ID
• Lab: rework CloudHarbor IAM into least-privilege roles

Section 17: Lab: Security Best Practices and Security Controls

• Network segmentation, security groups and web application firewalls
• Encryption at rest and in transit, and key management with KMS
• Storing secrets in Secrets Manager instead of in code
• Lab: enable encryption for the database and S3 and move credentials into Secrets Manager

Section 18: Lab: Vulnerability Management

• Scanning instances and container images for vulnerabilities
• Patch management and prioritising by risk
• Feeding scan results into the CI/CD pipeline and setting criteria that stop a deployment
• Lab: add container image scanning to the pipeline

Section 19: Compliance and Regulation

• Data sovereignty, data residency and data classification
• Relevant standards and laws such as ISO/IEC 27001 and Thailand's PDPA
• Audit trails and keeping evidence for audits
• Case study: choosing regions and data storage to meet organisational requirements

Section 20: Workshop Day 4: Monitoring Suspicious Activities

• Common cloud attacks such as credential leaks, misconfiguration and DDoS
• Using CloudTrail and logs to spot unusual behaviour
• Setting alerts and first response steps
• Workshop: turn on audit logging and alert on unusual sign-ins or permission changes

Section 21: Lab: Observability

• How metrics, logs and traces differ
• Building dashboards and alarms from key metrics with CloudWatch, compared with Azure Monitor
• Setting thresholds and reducing alert noise
• Lab: build a dashboard and alarms for CloudHarbor

Section 22: Lab: Scaling Approaches

• Vertical versus horizontal scaling
• Scheduled, dynamic and target tracking auto scaling
• Basic load testing to confirm scaling works
• Lab: set up auto scaling for the API and generate load to watch it scale out

Section 23: Backup, Recovery and Life Cycle Management

• Full, incremental and snapshot backups, with restore testing
• Disaster recovery strategies: backup and restore, pilot light, warm standby and active-active
• Resource life cycle: patching, upgrades, deprecation and decommissioning
• Lab: test database backup and restore against set RPO/RTO targets

Section 24: Troubleshooting Methodology

• A systematic method: identify the problem, form a theory, test, fix and document
• Deployment problems: template errors, exhausted quotas and missing dependencies
• Network and security problems: routing, DNS, security groups, IAM permissions and expired certificates
• Using logs, metrics and the CLI to find the root cause with evidence

Section 25: Master Workshop: A Simulated Outage

• Groups solve 3-4 scenarios such as a failed deployment, an unreachable database and denied permissions
• Present the root cause and how to prevent it
• Review how the 5 days of work map to the 6 CV0-004 domains
• Delete all resources with IaC and check Cost Explorer to keep costs under control